Brandon Rohrer
LightNews LightNews
banner
brandonrohrer.com
Brandon Rohrer
@brandonrohrer.com
3.6K followers 2.3K following 680 posts
Robotics and Reinforcement Learning tinkerer.
brandonrohrer.com
Wrangler of algorithms for Confluence @ Atlassian.
Eater of bread. Sipper of whisky.
Reports to a Shih Tzu.
Posts Replies Media Videos
brandonrohrer.com
New post on the guilty pleasures of triple mode redundancy.
Why build one when you can build three at triple the cost?

Just because you *can* do something, doesn't mean you should. But if it might be fun, go ahead and give it a whirl.

brandonrohrer.com/hosting7.html
Bomb-proof your website with mirroring Brandon Rohrer The Blog     RSS In previous posts, we’ve done our best to set up a website that is resilient to traffic, spikes, bots, and mischief of all sorts. ( I, II, III, IV, V VI VII ) But there are still plenty of other things that can go wrong. A good way to protect against this is mirroring. A mirror is like a backup website—not just a backup with the data but of everything, including the server and domain name. I built two additional mirrors for my blog website brandonrohrer.com. The symmetry of triple mode redundancy appeals to me, especially after hearing that it’s a principal used by NASA and growing up on some triples-themed sci-fi. You can take down one, but you still have two backups to work with, plenty of breathing room. If you get really unlucky, two will go down leaving you with a third. Why build one when you can build three at three times the cost? I tried to build in as much redundancy as possible. I got three domain names, each from a different domain name registrar. brandonrohrer.com from Namecheap, based in Phoenix. brandonrohrer.org from Hover, based in Toronto. brandonrohrer.at from Hostpoint, based outside Zurich.
November 27, 2025 at 3:41 AM
brandonrohrer.com
New Post: Autoblocking bots and scrapers in your server
brandonrohrer.com/hosting6.html

This one also comes with code:
codeberg.org/brohrer/webs...
In my last post I said "Automating firewall updates will be an adventure for another day." Today is that day. This is the latest in a growing series on hosting your own static blog. ( I, II, III, IV, V VI VII ) Protecting your website requires you to keep your eyes on it at all times. That can get tiring. Sometimes you need to eat and sleep and maybe work for a living. It can be useful to have automated helpers to fill those gaps. Detection The first step in keeping your blog traffic healthy is to be able to detect when someone is doing something they shouldn't. In my traffic control post I described five behaviors that I wanted to limit Scanning for secrets Fishing for files Rapid-fire requests Trying to hide rapid-fire requests Attempting unsupported actions The post describes these in words, but they need to be made more specific before they can be enforced by an automated detector. Doing this step well is where most of the art and cleverness is required. If you define a rule too narrowly, there will be a lot of IP addresses that should get blocked, but get missed (false negatives for the detector). On the other hand, if you define a rule too broadly, there will be a lot of legitimate IP traffic that gets blocked (false positives) and you will have a lot of sad readers who can't access your cat pictures.
November 12, 2025 at 12:37 PM
brandonrohrer.com
the gift for the one who has everything
Etsy webpage $69.00 Lobotomy Orbitoclast , Knife & Hammer Surgical Medical Tools This is the Museum quality replica version you will not find anywhere else You will receive 1 orbitoclast pick , 1 lobotomy knife, and 1 hammer
November 11, 2025 at 2:52 PM
brandonrohrer.com
New post: Controlling IP traffic on your webserver

A cool part about having your own webserver is that you get to choose who can visit. When IP addresses try to access sensitive files or aggressively scrape, you can just block them.

Here's how.

brandonrohrer.com/hosting5.html
Block an IP address The most straightforward way to block and IP address is in the firewall. It is the tool build specifically for this. To block the address 101.101.101.101, run from the command line sudo ufw insert 1 deny from 101.101.101.101 This instructs ufw (the Uncomplicated FireWall) to insert a rule at the the top of the list (position 1) to deny all incoming traffic from the address. After running this, no restart of the firewall is needed. The rule is active. (ufw docs The position 1 is important because in ufw, the first rule that matches is applied. If there was a rule to allow all addresses that started with 101. and that rule came before the deny rule, then the deny rule would never be reached. While it's possible to block specific ports, or even to block an IP address from seeing particular pages, complex rules and conditions get difficult to analyze very quickly, and can lead to cases where there are loopholes. Use fancy rule combinations sparingly. Parse logs In their raw form access logs are technically human-readable, but they are a lot. I found it really useful to do a little parsing to pull out the bits I'm interested in. (I'm working with the default nginx log format, so adjust this according to your own.) I wrote a script to take advantage of the repeatable structure of these logs to dissect them into their parts. It uses tricks like splitting the log based on brackets and spaces. It productes a pandas dataframe with columns containing the IP address, requested URI, HTTP status code, and every component of the date and time.
October 9, 2025 at 12:19 AM
brandonrohrer.com
Setting: Classic Tintin and Captain Haddock meme, modified Wednesday Addams: What a week, huh Sergeant? Captain: Wednesday, it's Captain
October 1, 2025 at 1:30 AM
brandonrohrer.com
Caring for Your Webserver is out.

It covers
- browsing the access logs
- catching missed pages
- automatically adding .html to requests, when needed
- redirecting URLs
- setting up log rotations
- finding a content provider for large files

brandonrohrer.com/hosting4.html
Caring for your webserver Brandon Rohrer The Blog     RSS In parts one through three, we set up a web server, connected it to a domain name, and instituted some basic security. Now comes the fun part! The web server is humming along doing its thing, and we can watch and admire, making little improvements here and there. It’s not required, but for some, this is part of the payoff. A webserver needs weeding and watering It can be counterintuitive that a thing made out of code should need ongoing attention and care. On the surface it seems like it should be self-sufficient, like a wall made of stones. We put the pieces in place where we want them and when we’re happy with it, we stop. It's all silicon and bits after all, why should it need watching? The bigger picture, though, is that the web server operates in a world that’s always changing. Software updates cause tools to behave differently. Edits happen to the HTML and other content we host. There are dramatic changes in who is trying to reach the content and for what purposes. There can be outages, policy changes, and any number of second-order effects in the wider world that can make our web server stop operating the way we want. So on that scale a web server starts to more closely resemble a vegetable garden—something growing, decaying, and very much a product of the environment that it's in. This page is my notes on care and feeding practices I've found helpful and enjoyable. I'm not an expert on this, and this is not authoritative by any means. But I put it here in case you find it helpful. If I missed anything, or got it egregiously wrong, please let me know.
September 28, 2025 at 10:41 PM
brandonrohrer.com
come on buddy i feel like you're not even trying
| 403 196.251.87.13 /images/images/cache.php?pass=3a0e007c895888c9c4bf234e2772a0dd | 403 196.251.87.13 /images/images/images/cache.php?pass=331b3elaefcffd452db92a2cicé61c525 lL 403 196.251.87.13 /images/images/images/images/cache.php?pass=26aadf8d261066584120034c6303716F | 403 196.251.87.13 /images/images/images/images/images/cache.php?pass=c93ef613c69e7f82b5446413c46bBaeca lL 403 196.251.87.13 /images/images/images/images/images/images/cache.php?pass=6765bcbc711528e2760d2133cdf17685 | 403 196.251.87.13 /images/images/images/images/images/images/images/cache.php?pass=e2f2d10231c076274cbc76336b530c67 | 403 196.251.87.13 /images/images/images/images/images/images/images/images/cache.php?pass=cfe52c34e32b72e0844fd3ac8c834e96 | 403 196.251.87.13 /images/images/images/images/images/images/images/images/images/cache.php?pass=b4a@cel105e127632d397c11b662c026 lL 403 196.251.87.13 /images/images/images/images/images/images/images/images/images/images/cache.php?pass=1105a5a43bd65cd41776c47401232849 | 403 196.251.87.13 /images/images/images/images/images/images/images/images/images/images/images/cache.php?pass=341a599afb55832de18a18d89cff3cse | 403 196.251.87.13 /wp—-admin/network/network/cache.phn?pass=38efBafddaalead7a?21aef35Fab6d?209
September 26, 2025 at 1:42 AM
brandonrohrer.com
My new pomodoro app doesn’t have many features, but there are also no updates and I won’t have to recharge it for 500 years.
A large hourglass by a pen, notebook, and pair of reading glasses
September 21, 2025 at 10:22 PM
brandonrohrer.com
The incomparable @b0rk.jvns.ca has partnered with the folks at git-SCM.com to create one heck of a cheat sheet

git-scm.com/cheat-sheet
Git Cheat Sheet Getting Started Start a new repo: git init Clone an existing repo: git clone <url> Prepare to Commit Add untracked file or unstaged changes: git add ‹ file> Add all untracked files and unstaged changes: git add • Choose which parts of a file to stage: git add -p Move file: git mv <old> ‹new>
September 16, 2025 at 10:59 PM
brandonrohrer.com
Blocking misbehaving ips on my server is a new pasttime. Sept 9 was when I figured out how to implement a block list.
A plot of bandwidth that shows a precipitous drop (more than nintey percent?) of bandwidth to something like 10 kilobytes per scond usage starting september 9.
September 14, 2025 at 10:08 PM
brandonrohrer.com
A cool thing about hosting my own website is that I get to see logs. Normal users are gratifying, but what's really cool are the ones doing shenanigans.

A pattern I saw today - apparently a group of ip addresses divvied up some of my pages into groups of 7-12 and visited them in alphabetical order.
18:25 200 185.220.100.250 /multiproc_pipeline.html 18:25 200 185.220.100.250 /multiprocessing.html 118:25 200 185.220.100.250 /numpy_resources.html 118:25 200 185.220.100.250 /one_on_ones.html 18:25 200 185.220.100.250 /open_the_black_box.html 18:26 200 185.220.100.250 /org_response.html 18:26 200 107.189.30.86 /oversimplify.html 18:26 200 107.189.30.86 /pendulum.html 18:26 200 107.189.30.86 /personal_toolbox.html 18:26 200 107.189.30.86 /play_and_record_sounds.html 18:26 200 107.189.30.86 /pocket_guide_data_science.html 18:26 200 107.189.30.86 /professional_path.html 18:26 200 107.189.30.86 /python_data_types.html 18:26 200 107.189.30.86 /python_resources.html 18:26 200 107.189.30.86 /range_normalization.html 18:26 200 45.84.107.174 /rate_of_change.html 18:26 200 45.84.107.174 /regularization.html 18:26 200 45.84.107.174 /rl_noninteger_delay.html 18:26 200 45.84.107.174 /[rss.html 18:26 200 45.84.107.174 /server_naming.html 18:26 200 45.84.107.174 /softmax.html 18:26 200 45.84.107.174 /sql_resources.html 18:26 200 45.84.107.174 /ssh_at_home.html 18:26 200 45.84.107.174 /standard_normalization.html 18:26 200 45.84.107.174 /stats_resources.html 18:26 200 104.244.79.50 /threading.html 18:26 200 104.244.79.50 /transformers.html 18:26 200 104.244.79.50 /uv_cheatsheet.html 18:26 200 104.244.79.50 /vim_md_colors.html 18:26 200 104.244.79.50 /what_nns_learn.html 18:26 200 104.244.79.50 /which_tool_should_i_use.html 18:26 301 104.244.79.50 /ziptie
September 14, 2025 at 3:17 AM
brandonrohrer.com
In part 3 of this series, "Beef up security on your webserver"
www.brandonrohrer.com/hosting3

Thanks to the kind netizens whose advice is gathered here. Flaws are mine.
Part 1 of this series showed how to create a new web server from scratch and Part 2 showed how to set up a new domain name on it. Now it's time to make that website more secure, so it can be protected from the rougher edges of the cyber world. Enable HTTPS Currently the web server we've built is only serving unencrypted (http) requests, rather than encrypted (https) requests. https has become the standard for the web. It's obviously useful when sharing personal information like credit card numbers and love notes, but it's even beneficial for seemingly benign browsing. It's hard to foresee all the ways that someone might use the browsing habits of your readers against them. To protect them, we'll set up https. As with so many topics there is an extremely accessible explanation of how https works in The Wizard Zine on http. If you have been following the other two posts closely, then you are perfectly set up to follow the DigitalOcean tutorial walking through https setup. It builds on all the pieces we've put in place: ufw, a sudo-capable non-root user, a domain name, DNS records, server blocks. I won't bother copying and pasting here. It's an excellent guide so I'll just point you to it.
September 6, 2025 at 12:39 PM
brandonrohrer.com
If you want to become the master of your own domain, here's how
www.brandonrohrer.com/hosting2
Attach your web server to a domain name Brandon Rohrer In part one of this series we set up a web server. The next step is to make it act like a real website. Buy a domain name The first thing to do is to name it. Typing http://138.197.69.146 to get to your content is impersonal, boring, and impossible to remember. The name of a website is its domain name. For example, the domain name for English-language Wikipedia is en.wikipedia.org. org is the top level domain (TLD). wikipedia is the second level domain. en is a subdomain. Top level domains come in two flavors, generic and country code. Generic top level domains (gTLDs) include some you are familiar with, like .com and .org, and a bunch you've probably never seen, like .anime and .tattoos. Country code top level domains (ccTLDs) are all two-letter country codes taken from ISO-3166. A few of the most common are .uk (United Kingdom), .de (Germany), and .cn (China). Sometimes people will get creative with country codes and repurpose them. The .ai (Antigua) ccTLD has been co-opted by a whole generation of startups. Same for .io (British Indian Ocean Territory). .me (Montenegro) is a fun one for personalized websites, and the US state of Maine. .it (Italy) and .to (Tonga) are useful for spelling English phrases and words like this.is.it and p.ota.to.
September 3, 2025 at 1:48 AM
brandonrohrer.com
One of my most visited posts is on how to set up ssh for a home network. I wonder if there's more of that happening nowadays.
www.brandonrohrer.com/ssh_at_home
Security measures There are a few things you can do to make your setup more secure against anyone who might want to come and mess around where they're not wanted. Use an ssh key instead of the server account password. Use a passphrase with you ssh key. Use a port other than 22. Use an allow list. Don't allow root login. Enable verbose logging. So you can check on anything hinky. Periodically update sshd.
September 1, 2025 at 10:46 AM
brandonrohrer.com
It’s surreal to see Tech Review backing off on breathless AI hype to a more measured stance. I don’t hate it.
#ReinforcementLearning
Planet-size pigeon brains This familiar bird has never gotten much credit for being intelligent. But the reinforcement learning powering the world's most advanced Al systems is far more pigeon than human. By Ben Crair
August 31, 2025 at 1:22 PM
brandonrohrer.com
Hey bsky #networking and #linux folks, can I get your eyes on something? I wanted to make a beginner friendly guide for hosting your own static website, and I wanted to make it simple but secure.

Do you see anything boneheaded here? any best practices I left out?

www.brandonrohrer.com/hosting.html
Hosting your own website Brandon Rohrer Creating a web page is only the beginning. The business of sharing it with the world has a lot of moving parts and a lot of choke points. If an ISP decides to stop traffic to your website or if your hosting platform goes bankrupt there isn't a lot you can do about it. But what you can do is have a solid Plan B — being ready to spin up another copy of your website on another server. A server that you control, or at least a server of your choosing. This guide shows one way to do set up your own hosting. It's not the only way or even the best way. But it is at least a path through the desert. Choose a computer There are lots of cloud providers out there, of all sizes and in a lot of difference countries. Pick one. Or use a computer you have at home, if your ISP will let you get away with serving a website from it. | chose Digital Ocean because | had heard some good things about it and because it wasn't AWS. The first step there is to create an account on Digital Ocean by setting up a "Team", even if it's just you. Add an ssh key Create a public/private key pair on your local machine. Follow the Digital Ocean menus to and follow the instructions there and here are some related docs . It's recommended to create a passphrase for your keys, but don't forget to write it down.
August 27, 2025 at 12:57 AM
brandonrohrer.com
I can’t wait for this!
DataBS Conf You successfully placed your order and
August 23, 2025 at 12:59 AM
brandonrohrer.com
Them: I hope this email finds you well

How the email finds me:
A gremlin of a white Shih tzu, tongue out, in a blur
August 22, 2025 at 12:26 AM
brandonrohrer.com
Hey bsky #RSS aficionados, I wrote a beginner's guide to publishing a feed. If you'd like to pick it apart before I start sharing it more broadly I'd welcome your reactions and "well, actually..."s

brandonrohrer.com/rss.html
How to start publishing an RSS feed Before Twitter, before LinkedIn, before Facebook, there was RSS. Really Simple Syndication is the photocopied ‘zine of microblogging. If there were social media in Mad Max, it would have been RSS. It's totally outside any centralized control, cheap, gritty, and punk af. Reading RSS The toughest thing to get used to is that there is no central platform. RSS is just a bunch of people creating RSS-formatted files and posting them on the internet. The burden of assembling them into a reading list falls on the reader. Thankfully there aggregators, helpful programs that regularly check those RSS files for changes and lay them out for you in a feed. | use Feedly daily, and enjoy Inoreader too. I've also heard that Feeder and NewsBlur are solid options. There are plenty of others, some with niche functionality. The cool part is that there isn't a "main" one or a home base. They're all their own thing. All they do is gather up changes and put them in a list for you. To subscribe to someone's feed, you'll need to get the URL. These are frequently posted on their blog under an "RSS feed" link or the RSS logo. The URL is to an .xml file. For my blog it looks like https://brandonrohrer.com/feed.xml
August 18, 2025 at 11:19 AM
brandonrohrer.com
good trip to the used book store this weekend
Cover of CYBERNETICS By Norbert Wiener Snapshot of an inside page describing a stable, negative feedback loop
August 18, 2025 at 12:24 AM
brandonrohrer.com
embrace it
Mouse from the matrix with the caption: Pay no attention to these hypocrites. To deny our own jank is to deny the very thing that makes us human.
August 14, 2025 at 12:11 PM
brandonrohrer.com
Every time I touch audio conversions and base64 encoding I have to track it down and work it out anew. No more!
www.brandonrohrer.com/audio_conver...
Read an .mp3 to a Numpy array audio_data, samplerate = sf.read(mp3_filename) Write a Numpy array to an .mp3 file. sf.write(mp3_filename, audio_data, samplerate) Convert a Numpy array to a string of .mp3-formatted bytes. mp3_buf = io.BytesIO() mp3_buf.name = 'file.mp3' sf.write(mp3_buf, audio_data, samplerate) mp3_buf.seek(0) # Necessary for read() to return all bytes mp3_bytes = mp3_buf.read() An mp3_buf name that ends in .mp3 is important because soundfile infers file type from the filename extension. Convert a string of .mp3-formatted bytes to a Numpy array. new_mp3_buf = io.BytesIO(mp3_bytes) new_mp3_buf.name = 'new_file.mp3' new_audio_array, new_samplerate = sf.read(new_mp3_buf) Convert a string of bytes to a base64-encoded ASCII string. base64_mp3_bytes = base64.b64encode(mp3_bytes) base64_mp3_string = base64_mp3_bytes.decode("ascii") Convert a base64-encoded ASCII string to a string of bytes. new_base64_mp3_bytes = base64_mp3_string.encode("ascii") new_mp3_bytes = base64.b64decode(new_base64_mp3_bytes)
August 14, 2025 at 2:08 AM
brandonrohrer.com
I wrote a thing about measuring temperature using an #Arduino sensor and microprocessor.

If you're willing to sacrifice a little lag, you can get shockingly accurate measurements of the air temperature with a little filtering.

www.brandonrohrer.com/arduino_temp...
temp measured equals temp world plus delta heating and delta convection The raw temperature measurement is a jagged line jumping up and down by a full degree C peak-to-peak. The filtered temperature tracks changes much more smoothly and slowly, jittering by less than a hundredth of a degree. It's easy to imagine that it gets closer to measuring the actual world temperature, and that it removes a lot of the noise introduced by our measurement process.
August 3, 2025 at 11:05 AM
brandonrohrer.com
Updating my blog footer
The opinions here are wholly my own. Certified 100% Human-generated.
July 28, 2025 at 10:40 PM
brandonrohrer.com
A one photo essay on empirical epistemology
Six cheap digital thermometers lined up in a row, each showing a different temperature between 73.0 and 76.1°F
July 21, 2025 at 11:02 PM